RTEMS | fcntl(F_DUPFD) ignores its third argument (#5668)

[Sang Woo Kim (@sngwkim915)]

Issue created by Sang Woo Kim: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5668



## Summary

POSIX says `F_DUPFD` returns the lowest available descriptor greater than or equal to the third argument, and answers `EINVAL` if that argument is negative or not a valid descriptor number. `vfcntl()` in `cpukit/libcsupport/src/fcntl.c` never reads the argument — it calls `duplicate_iop( iop )`, which takes the next free iop. Measured on `6` and `main`, arm/xilinx_zynq_a9_qemu, 64 iops, descriptors 3..14 free:

```
fcntl(s, F_DUPFD, 40)   -> 4     (POSIX: >= 40)
fcntl(s, F_DUPFD, 72)   -> 8     (72 > rtems_libio_number_iops; POSIX: EINVAL)
fcntl(s, F_DUPFD, -1)   -> 9     (POSIX: EINVAL)
```

A caller that uses the argument to move a descriptor out of a range gets one inside it, and no error. Descriptors are handed out in free-list order, so the result is not the lowest available either.

If #5667 adds `F_DUPFD_CLOEXEC` it takes the same body, so whatever `duplicate_iop()` grows to accept serves both.

## Steps to reproduce

```c
int s = open("/dev/console", O_RDWR);
int d = fcntl(s, F_DUPFD, 40);   /* the next free descriptor, not >= 40 */
```

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5668
You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/4-8tewdqlwxnpbmj745jpxdo1m5-1d/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260728/1f84ac8c/attachment.htm>